> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/hacking-wifi/wpa-wpa2-psk-network-attacks/traffic-manipulation/airdecap-packet-decryption.md).

# Airdecap 数据包解密

使用 Airdecap-ng 解密授权的 WiFi 捕获并检查 HTTP 流量。

加密的 WiFi 捕获包无法直接检查。例如，在解密捕获包之前按 HTTP 流量过滤不会返回结果：

{% code overflow="wrap" %}

```bash
tshark -r Capture-01.cap -Y "http"
```

{% endcode %}

那样不会起作用

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FoacSMyZCXiIjiG4R0LWR%2Fimage.png?alt=media&amp;token=0c0a8a35-f9a3-4ca9-b5f6-b7b3282a8eb3" alt="" width="408"><figcaption></figcaption></figure>

### 解密 WiFi 捕获包

当你提供正确的网络名称和密码短语时，Airdecap-ng 会解密 WiFi 层。随后就可以检查生成的捕获包。

错误的密码短语无法解密流量：

{% code overflow="wrap" %}

```bash
airdecap-ng -e jordan -p PasswordIncorrect1234 capture_jordan2-01.cap
```

{% endcode %}

使用正确的密码短语来解密捕获包：

{% code overflow="wrap" %}

```bash
airdecap-ng -e jordan -p 92212345 capture_jordan2-01.cap
```

{% endcode %}

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FivLAinMs1qqTvdn1t4sx%2Fimage.png?alt=media&amp;token=fef82bc2-79d9-4ec2-85f8-973237d61bb2" alt=""><figcaption></figcaption></figure>

### 检查 HTTP 请求

Airdecap-ng 会创建一个解密后的捕获文件。按 HTTP POST 请求对其进行过滤：

{% code overflow="wrap" %}

```bash
tshark -r capture_jordan-01-dec.cap -Y "http.request.method==POST" -Tjson 2>/dev/null
```

{% endcode %}

当应用程序使用未加密的 HTTP 时，输出会显示提交的表单数据。

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FlOQYVAEg5u63rOakP70d%2Fimage.png?alt=media&amp;token=4817a197-4c67-4345-a876-5fb0ffd729a6" alt=""><figcaption></figcaption></figure>

要更详细地检查提交的 HTTP 字段：

{% code overflow="wrap" %}

```bash
tshark -r capture_jordan-01-dec.cap -Y "http.request.method==POST" -Tjson -e http.file_data 2>/dev/null
```

{% endcode %}

WiFi 解密不会解密 HTTPS。HTTPS 请求正文仍然受保护。

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2FoZXDNUCZ75W3pexPoqLs%2Fimage.png?alt=media&amp;token=8152b932-f6f3-47fe-b991-e94e5b47866b" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/hacking-wifi/wpa-wpa2-psk-network-attacks/traffic-manipulation/airdecap-packet-decryption.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
